@wardby/cli 0.7.0 → 0.9.0

package/help/troubleshooting/debugging-agent-runs.md

@@ -0,0 +1,29 @@
+---
+id: troubleshooting/debugging-agent-runs
+title: Debug an agent run
+summary: Triage a run that failed, opened no pull request, or missed what you expected, using the MCP tools and GitHub without server logs.
+audience: operator
+tags: [debugging, triage, get_run, list_runs, failureCategory, diagnosticId, get_run_transcript, no_changes]
+appliesTo: >=0.7.0
+---
+
+# Debug an agent run
+
+Find the run with `list_runs`, read it with `get_run`, then follow what you see.
+Without an `agentId`, `list_runs` lists your runs across every agent (from
+Wardby 0.8.0); add `active: true` or `since` to narrow it.
+
+| What you see                  | What to check                                                                                      |
+| ----------------------------- | -------------------------------------------------------------------------------------------------- |
+| No run started                | `list_repositories` on the router: is a link holding the trigger you used?                         |
+| Failed or refused             | `status`, `error`, `failureCategory` and the final text. Call `search_help` with the category      |
+| Lead ran, no coding run       | The lead's final text, which should say why it didn't delegate                                     |
+| Succeeded, no pull request    | `codingResult.outcome`: `no_changes`, `budget_exhausted`, or `branch_pushed` on a local repository |
+| Pull request missed the point | The diff, the review, the original request, and `request` on `get_run` (from Wardby 0.8.0)         |
+
+A failed coding run's specific reason is only in the server log. Send an operator
+the run ID and its `diagnosticId`. For Claude Code agents with `sessionResume` on,
+`get_run_transcript` shows what the agent did; see
+[Resume Claude Code runs locally](../resume-runs-locally.md).
+
+The full guide is [Debugging an agent run](../../docs/debugging-agent-runs.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wardby/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Self-hosted control plane for budget-guarded AI agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/wardby/wardby#readme",
@@ -158,6 +158,7 @@
   },
   "overrides": {
     "deepmerge-ts": "8.0.2",
+    "minimatch": "11.0.3",
     "mysql2": "3.24.4",
     "uuid": "11.1.1"
   }

package/prisma/migrations/20261102000000_host_providers/migration.sql

@@ -0,0 +1,56 @@
+-- Tool-backed host providers: config and approved snapshots. No secret values.
+CREATE TABLE "HostProvider" (
+    "name" TEXT NOT NULL,
+    "contractVersion" INTEGER NOT NULL,
+    "gitHost" TEXT NOT NULL,
+    "apiHosts" TEXT[],
+    "gitUsername" TEXT NOT NULL,
+    "pullRequestUrlTemplate" TEXT NOT NULL,
+    "repositoryApiPath" TEXT NOT NULL,
+    "permissionApiPath" TEXT,
+    "webhook" JSONB NOT NULL,
+    "webhookSecretId" TEXT NOT NULL,
+    "permissionSecretId" TEXT,
+    "createdById" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "HostProvider_pkey" PRIMARY KEY ("name")
+);
+
+CREATE TABLE "HostProviderOperation" (
+    "provider" TEXT NOT NULL,
+    "operation" TEXT NOT NULL,
+    "toolId" TEXT,
+    "code" TEXT NOT NULL,
+    "paramsZod" TEXT NOT NULL,
+    "approvedById" TEXT NOT NULL,
+    "approvedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "HostProviderOperation_pkey" PRIMARY KEY ("provider", "operation")
+);
+
+CREATE TABLE "HostProviderCredential" (
+    "id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "repositoryPattern" TEXT NOT NULL,
+    "secretId" TEXT NOT NULL,
+    "credentialKind" TEXT NOT NULL DEFAULT 'static',
+    CONSTRAINT "HostProviderCredential_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "HostProviderTrustedAccount" (
+    "provider" TEXT NOT NULL,
+    "accountId" TEXT NOT NULL,
+    "addedById" TEXT NOT NULL,
+    "addedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "HostProviderTrustedAccount_pkey" PRIMARY KEY ("provider", "accountId")
+);
+
+CREATE UNIQUE INDEX "HostProviderCredential_provider_repositoryPattern_key" ON "HostProviderCredential"("provider", "repositoryPattern");
+
+ALTER TABLE "HostProvider" ADD CONSTRAINT "HostProvider_webhookSecretId_fkey" FOREIGN KEY ("webhookSecretId") REFERENCES "Secret"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "HostProvider" ADD CONSTRAINT "HostProvider_permissionSecretId_fkey" FOREIGN KEY ("permissionSecretId") REFERENCES "Secret"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "HostProviderOperation" ADD CONSTRAINT "HostProviderOperation_provider_fkey" FOREIGN KEY ("provider") REFERENCES "HostProvider"("name") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "HostProviderOperation" ADD CONSTRAINT "HostProviderOperation_toolId_fkey" FOREIGN KEY ("toolId") REFERENCES "Tool"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "HostProviderCredential" ADD CONSTRAINT "HostProviderCredential_provider_fkey" FOREIGN KEY ("provider") REFERENCES "HostProvider"("name") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "HostProviderCredential" ADD CONSTRAINT "HostProviderCredential_secretId_fkey" FOREIGN KEY ("secretId") REFERENCES "Secret"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "HostProviderTrustedAccount" ADD CONSTRAINT "HostProviderTrustedAccount_provider_fkey" FOREIGN KEY ("provider") REFERENCES "HostProvider"("name") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261104000000_coding_agent_repository_list/migration.sql

@@ -0,0 +1,5 @@
+-- A coding agent may work in several repositories: each link can name its own base
+-- branch, and a run records that its repository came from a link.
+ALTER TABLE "AgentRepository" ADD COLUMN "baseRef" TEXT;
+ALTER TABLE "CodingRun" ADD COLUMN "viaRepositoryLink" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "NativeGatewayCall" ADD COLUMN "childRepository" TEXT;

package/prisma/migrations/20261106000000_tool_timeout/migration.sql

@@ -0,0 +1,4 @@
+-- A sandboxed tool may set its own time limit per call, in milliseconds. Null keeps the
+-- default limit. A host provider's approved snapshot of a tool keeps the value it approved.
+ALTER TABLE "Tool" ADD COLUMN "timeoutMs" INTEGER;
+ALTER TABLE "HostProviderOperation" ADD COLUMN "timeoutMs" INTEGER;

package/prisma/migrations/20261107000000_mcp_servers/migration.sql

@@ -0,0 +1,33 @@
+-- Remote MCP servers an owner registers, and their attachments to native agents.
+CREATE TABLE "McpServer" (
+    "id" TEXT NOT NULL,
+    "ownerId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "url" TEXT NOT NULL,
+    "secretNames" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "toolSnapshot" JSONB NOT NULL DEFAULT '[]',
+    "snapshotAt" TIMESTAMP(3),
+    "serverInfo" JSONB,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "McpServer_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "AgentMcpServer" (
+    "agentId" TEXT NOT NULL,
+    "serverId" TEXT NOT NULL,
+    "allowedTools" TEXT[],
+    "callTimeoutMs" INTEGER,
+    "attachedById" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "AgentMcpServer_pkey" PRIMARY KEY ("agentId", "serverId")
+);
+
+CREATE UNIQUE INDEX "McpServer_ownerId_name_key" ON "McpServer"("ownerId", "name");
+CREATE INDEX "McpServer_ownerId_idx" ON "McpServer"("ownerId");
+CREATE INDEX "AgentMcpServer_serverId_idx" ON "AgentMcpServer"("serverId");
+
+ALTER TABLE "McpServer" ADD CONSTRAINT "McpServer_ownerId_fkey" FOREIGN KEY ("ownerId") REFERENCES "Principal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "AgentMcpServer" ADD CONSTRAINT "AgentMcpServer_agentId_fkey" FOREIGN KEY ("agentId") REFERENCES "Agent"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "AgentMcpServer" ADD CONSTRAINT "AgentMcpServer_serverId_fkey" FOREIGN KEY ("serverId") REFERENCES "McpServer"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261108000000_coding_mcp/migration.sql

@@ -0,0 +1,5 @@
+-- Coding runs: pinned MCP tools, the MCP token's hash, and a call counter.
+ALTER TABLE "CodingProxySession" ADD COLUMN "mcpTools" JSONB;
+ALTER TABLE "CodingProxySession" ADD COLUMN "mcpTokenHash" TEXT;
+ALTER TABLE "CodingProxySession" ADD COLUMN "mcpCallCount" INTEGER NOT NULL DEFAULT 0;
+CREATE UNIQUE INDEX "CodingProxySession_mcpTokenHash_key" ON "CodingProxySession"("mcpTokenHash");

package/prisma/migrations/20261109000000_task_run_index/migration.sql

@@ -0,0 +1,3 @@
+-- The run-drivability and cancelled-task lookups filter Task on (runId, status); the drivability
+-- check runs on every coding MCP request.
+CREATE INDEX "Task_runId_status_idx" ON "Task"("runId", "status");

package/prisma/migrations/20261110000000_run_steps/migration.sql

@@ -0,0 +1,26 @@
+-- Run steps: one line per tool call or model message, and the count of steps past the per-run cap.
+ALTER TABLE "Run" ADD COLUMN "stepsDropped" INTEGER NOT NULL DEFAULT 0;
+
+CREATE TABLE "RunStep" (
+    "id" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "seq" INTEGER NOT NULL,
+    "at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "kind" TEXT NOT NULL,
+    "tool" TEXT,
+    "callId" TEXT,
+    "summary" TEXT NOT NULL,
+    "status" TEXT,
+    "detail" TEXT,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "RunStep_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "RunStep_runId_seq_key" ON "RunStep"("runId", "seq");
+
+CREATE INDEX "RunStep_runId_callId_idx" ON "RunStep"("runId", "callId");
+
+CREATE INDEX "RunStep_expiresAt_idx" ON "RunStep"("expiresAt");
+
+ALTER TABLE "RunStep" ADD CONSTRAINT "RunStep_runId_fkey"
+    FOREIGN KEY ("runId") REFERENCES "Run"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261111000000_run_steps_viewer_notify/migration.sql

@@ -0,0 +1,59 @@
+-- Live run steps for the admin viewer (docs/viewer-api.md): a `step` event when a
+-- step is recorded and when its status arrives. Only stored columns are sent:
+-- the summary is already redacted when the row is written; the call id and the
+-- detail text are never sent. Every other branch is unchanged.
+CREATE OR REPLACE FUNCTION wardby_viewer_notify() RETURNS trigger LANGUAGE plpgsql AS $$
+DECLARE
+  payload jsonb;
+BEGIN
+  IF TG_TABLE_NAME = 'Run' THEN
+    IF TG_OP = 'UPDATE'
+       AND NEW."status" IS NOT DISTINCT FROM OLD."status"
+       AND NEW."turns" IS NOT DISTINCT FROM OLD."turns"
+       AND NEW."costUsd" IS NOT DISTINCT FROM OLD."costUsd"
+       AND NEW."tokensIn" IS NOT DISTINCT FROM OLD."tokensIn"
+       AND NEW."tokensOut" IS NOT DISTINCT FROM OLD."tokensOut"
+       AND NEW."finishedAt" IS NOT DISTINCT FROM OLD."finishedAt"
+       AND NEW."parentRunId" IS NOT DISTINCT FROM OLD."parentRunId" THEN
+      RETURN NULL; -- heartbeat-only and other invisible updates
+    END IF;
+    payload := jsonb_build_object(
+      'kind', 'run', 'runId', NEW."id", 'parentRunId', NEW."parentRunId", 'agentId', NEW."agentId",
+      'status', NEW."status", 'turns', NEW."turns", 'tokensIn', NEW."tokensIn", 'tokensOut', NEW."tokensOut",
+      'costUsd', NEW."costUsd"::float8,
+      'finishedAt', to_char(NEW."finishedAt", 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'));
+  ELSIF TG_TABLE_NAME = 'CodingRunServiceStatus' THEN
+    payload := jsonb_build_object(
+      'kind', 'service', 'runId', NEW."runId", 'name', NEW."name", 'state', NEW."state", 'attempts', NEW."attempts");
+  ELSIF TG_TABLE_NAME = 'IssuePullRequest' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."openedByRunId", 'source', 'pull_request');
+  ELSIF TG_TABLE_NAME = 'RunHostStatus' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'host_status');
+  ELSIF TG_TABLE_NAME = 'RunIssueStatus' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'issue_status');
+  ELSIF TG_TABLE_NAME = 'RunHostCheck' THEN
+    payload := jsonb_build_object('kind', 'outcome', 'runId', NEW."runId", 'source', 'host_check');
+  ELSIF TG_TABLE_NAME = 'RunStep' THEN
+    IF TG_OP = 'UPDATE' AND NEW."status" IS NOT DISTINCT FROM OLD."status" THEN
+      RETURN NULL; -- only a step's status is shown as it changes
+    END IF;
+    payload := jsonb_build_object(
+      'kind', 'step', 'runId', NEW."runId", 'seq', NEW."seq", 'stepKind', NEW."kind", 'tool', NEW."tool",
+      'summary', NEW."summary", 'status', NEW."status",
+      'at', to_char(NEW."at", 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'));
+  ELSE
+    RETURN NULL;
+  END IF;
+  -- A viewer event must never fail the write that caused it (e.g. a payload
+  -- over NOTIFY's 8000-byte limit).
+  BEGIN
+    PERFORM pg_notify('wardby_viewer', payload::text);
+  EXCEPTION WHEN OTHERS THEN
+    NULL;
+  END;
+  RETURN NULL;
+END;
+$$;
+
+CREATE TRIGGER "RunStep_viewer_notify" AFTER INSERT OR UPDATE ON "RunStep"
+  FOR EACH ROW EXECUTE FUNCTION wardby_viewer_notify();

package/prisma/migrations/20261112000000_run_steps_detail/migration.sql

@@ -0,0 +1,9 @@
+-- Run steps detail level: the owner's per-agent setting, the level fixed on each run at
+-- dispatch, and the proxy session's copy of it. Additive, nullable: existing rows mean "unset".
+CREATE TYPE "RunStepsLevel" AS ENUM ('off', 'summary', 'detail');
+
+ALTER TABLE "Agent" ADD COLUMN "runSteps" "RunStepsLevel";
+
+ALTER TABLE "Run" ADD COLUMN "runStepsLevel" "RunStepsLevel";
+
+ALTER TABLE "CodingProxySession" ADD COLUMN "runStepsLevel" "RunStepsLevel";

package/prisma/schema.prisma

@@ -20,18 +20,18 @@ datasource db {
 }
 
 model Agent {
-  id            String              @id @default(cuid())
-  name          String              @unique
-  systemPrompt  String
-  model         String
-  budgetUsd     Decimal             @db.Decimal(10, 4)
+  id                    String              @id @default(cuid())
+  name                  String              @unique
+  systemPrompt          String
+  model                 String
+  budgetUsd             Decimal             @db.Decimal(10, 4)
   /// Percent above budgetUsd a run may spend: each coding run's limit, or (on a lead agent) its run tree's ceiling for coding sub-agents; native model calls are unaffected; group caps still apply.
-  allowedOverrunPercent Int @default(0)
-  createdAt     DateTime            @default(now())
-  updatedAt     DateTime            @updatedAt
-  runs          Run[]
-  kind          AgentKind           @default(native)
-  codingProfile CodingAgentProfile?
+  allowedOverrunPercent Int                 @default(0)
+  createdAt             DateTime            @default(now())
+  updatedAt             DateTime            @updatedAt
+  runs                  Run[]
+  kind                  AgentKind           @default(native)
+  codingProfile         CodingAgentProfile?
 
   // Phase 2: scheduling. `schedule` is a cron expression; null = manual-only.
   schedule        String?
@@ -60,6 +60,7 @@ model Agent {
   repositories         AgentRepository[]
   deferredReviews      DeferredReview[]
   issueProjects        AgentIssueProject[]
+  mcpServers           AgentMcpServer[]
   notificationChannels NotificationChannel[]
 
   /// Self-defects opt-in: the Jira project and issue type wardby files the agent's own failures into. Both or neither.
@@ -86,6 +87,9 @@ model Agent {
   /// single-use worker container/pod. Each Run snapshots this at creation
   /// (Run.nativeExecutionMode), so a change reaches only later runs.
   nativeExecutionMode NativeExecutionMode @default(control_plane)
+  /// The owner's run steps level for this agent's runs; null = unset (summary). A run records
+  /// min(WARDBY_RUN_STEPS, this), fixed at dispatch (Run.runStepsLevel). Owner-only.
+  runSteps RunStepsLevel?
 
   /// Un-phased: sub-agent composition edges (see AgentSubAgent below). An
   /// agent can be a parent (has children it can delegate to) and/or a
@@ -143,6 +147,15 @@ enum AgentKind {
   coding
 }
 
+/// Run steps level (docs/debugging-agent-runs.md#run-steps): off records nothing, summary one
+/// redacted line per step, detail also a redacted detail text (tool input, the tail of tool
+/// output, model text).
+enum RunStepsLevel {
+  off
+  summary
+  detail
+}
+
 /// Where a native agent's runs execute (Agent.nativeExecutionMode).
 enum NativeExecutionMode {
   control_plane @map("control-plane")
@@ -186,6 +199,10 @@ model Tool {
   jsonSchema  Json
   /// Tool body source; run inside the sandbox with the validated params.
   code        String
+  /// The tool's own time limit per call (ms). Null = the default (10 s). A
+  /// run uses the lower of this and WARDBY_TOOL_MAX_TIMEOUT_MS, and pins the
+  /// value its load step read, like the code.
+  timeoutMs   Int?
   createdAt   DateTime    @default(now())
   updatedAt   DateTime    @updatedAt
   agents      AgentTool[]
@@ -195,6 +212,8 @@ model Tool {
   ownerId String?
   owner   Principal? @relation(fields: [ownerId], references: [id])
 
+  hostProviderOperations HostProviderOperation[]
+
   @@unique([ownerId, name])
 }
 
@@ -393,6 +412,12 @@ model Run {
   /// run through the server's executor and clears this.
   stopRequestedAt      DateTime?
   stopRequestReason    String?
+  /// Run steps (RunStep) not recorded because the run already had MAX_RUN_STEPS (2,000).
+  stepsDropped         Int                      @default(0)
+  /// The run steps level this run records, fixed at dispatch: min(WARDBY_RUN_STEPS, Agent.runSteps
+  /// or summary). Null on runs from before the field (they record at most summary).
+  runStepsLevel        RunStepsLevel?
+  steps                RunStep[]
 
   /// Un-phased: sub-agent dispatch (see AgentSubAgent). Null for a
   /// top-level run; set when this run was created by a parent run's
@@ -425,6 +450,7 @@ model Run {
   /// text, no FK.
   triggeredById           String?
 
+  @@unique([parentRunId, parentCallId])
   @@index([agentId, triggeredById])
   /// The admin viewer's graph window (runs started since a time, or still
   /// pending/running) and its ancestor/children walks (docs/viewer-api.md).
@@ -433,7 +459,6 @@ model Run {
   @@index([parentRunId])
   @@index([startDeferredAt])
   @@index([stopRequestedAt])
-  @@unique([parentRunId, parentCallId])
 }
 
 /// Phase 5: owner-configured coding behavior. Runtime credentials and opaque
@@ -572,6 +597,9 @@ model CodingRun {
   baseSha               String?
   /// Step in the request's merge order set by the delegating agent (1 = first); null = no order.
   mergeOrder            Int?
+  /// Fixed at dispatch: this run's repository came from an AgentRepository link, not the
+  /// profile, so that link must still exist whenever the run uses the repository.
+  viaRepositoryLink     Boolean             @default(false)
   /// When Wardby marked this run's pull request ready for review (at most once;
   /// a person moving it back to draft is final). Only set on a root coding run.
   markedReadyAt         DateTime?
@@ -642,6 +670,37 @@ model RunTranscript {
   @@index([expiresAt])
 }
 
+/// One line of what a run did: a tool call (with its status once the result is back) or what the
+/// model said. Derived by trusted code from model traffic and written only by the control plane's
+/// RunStepWriter, after exact-value redaction against the run's secret values
+/// (docs/debugging-agent-runs.md#run-steps). Never tool output at the summary level.
+model RunStep {
+  id        String   @id @default(cuid())
+  runId     String
+  run       Run      @relation(fields: [runId], references: [id], onDelete: Cascade)
+  /// Order within the run, from 1.
+  seq       Int
+  at        DateTime @default(now())
+  /// "tool" | "said"
+  kind      String
+  /// The tool's display name (Bash for every agent's shell tool, mcp:<name>, Edit, ...); null for "said".
+  tool      String?
+  /// The provider's call id (to attach the result), or a said:<key> id; never returned by MCP.
+  callId    String?
+  /// Redacted, at most 300 characters.
+  summary   String
+  /// ok | error | exit N, set when the result arrives.
+  status    String?
+  /// The detail level's text: redacted tool input (~4 KB), then the last ~2 KB of its output once
+  /// the result is back, or the model's text (~8 KB). At most 16,384 characters. Null below detail.
+  detail    String?
+  expiresAt DateTime
+
+  @@unique([runId, seq])
+  @@index([runId, callId])
+  @@index([expiresAt])
+}
+
 /// Coding-run services (docs/coding-services.md): the catalog a repository's
 /// .wardby/services.yaml names entries from. Admin-managed over MCP
 /// (list/get_service: agents:read; create/update/delete_service:
@@ -846,6 +905,8 @@ model NativeGatewayCall {
   childRunId        String?
   /// A delegation's sub-agent, recorded at admission (it holds a place while waiting for budget).
   childAgentId      String?
+  /// A coding delegation's repository, recorded with childAgentId. Null = the child's default.
+  childRepository   String?
   createdAt         DateTime                @default(now())
   updatedAt         DateTime                @updatedAt
   completedAt       DateTime?
@@ -893,6 +954,15 @@ model CodingProxySession {
   dependencyCacheLockHashes String[]                 @default([])
   /// Set when the run's dependency step is over; after it the cache refuses this session.
   dependencyCacheSealedAt   DateTime?
+  /// Phase 2 of remote MCP servers: the run's pinned MCP tools (no URLs or secrets), or null.
+  mcpTools                  Json?
+  /// SHA-256 (base64url) of the run's MCP token; null when the run has no MCP tools.
+  mcpTokenHash              String?                  @unique
+  /// The run's Run.runStepsLevel, copied at session creation: the proxy sends a tool result's
+  /// output tail to the run-steps listener only at detail. Null on older sessions (= summary).
+  runStepsLevel             RunStepsLevel?
+  /// MCP tools/call count for this run (capped by WARDBY_MCP_MAX_CALLS_PER_RUN).
+  mcpCallCount              Int                      @default(0)
 
   @@index([deadlineAt])
 }
@@ -1121,6 +1191,7 @@ model Principal {
   webhooks     Webhook[]
   authUser     AuthUser?
   budgetGroups BudgetGroup[]
+  mcpServers   McpServer[]
 
   hostIdentities           HostIdentity[]
   hostIdentityLinkRequests HostIdentityLinkRequest[]
@@ -1135,7 +1206,7 @@ model Principal {
 /// AgentRepository.provider, so a new type or level needs no enum migration.
 model ResourceGrant {
   id                 String     @id @default(cuid())
-  /// "agent" | "tool" | "budget_group" (later "secret" | "datastore").
+  /// "agent" | "tool" | "budget_group" | "mcp_server" (later "secret" | "datastore").
   resourceType       String
   resourceId         String
   /// "principal" | "everyone" (later "group").
@@ -1193,6 +1264,9 @@ model Task {
   ttlAt          DateTime
   createdAt      DateTime   @default(now())
   updatedAt      DateTime   @updatedAt
+
+  /// The run-drivability and cancelled-task lookups: findFirst({ runId, status: "cancelled" }).
+  @@index([runId, status])
 }
 
 /// Phase 4: a secret value, encrypted at rest via the SecretCipher seam.
@@ -1211,6 +1285,10 @@ model Secret {
   updatedAt  DateTime      @updatedAt
   agents     AgentSecret[]
 
+  hostProviderWebhooks    HostProvider[]           @relation("HostProviderWebhookSecret")
+  hostProviderPermissions HostProvider[]           @relation("HostProviderPermissionSecret")
+  hostProviderCredentials HostProviderCredential[] @relation("HostProviderCredentialSecret")
+
   @@unique([ownerId, name])
 }
 
@@ -1320,7 +1398,7 @@ model AuthUser {
   displayName String?
   status      String                   @default("enabled")
   /// wardby roles (src/mcp/auth/resource-server.ts ROLE_PERMISSIONS: admin,
-  /// package-approver, service-manager, model-manager), set with `wardby auth user grant`. Empty = member.
+  /// package-approver, service-manager, model-manager, host-manager), set with `wardby auth user grant`. Empty = member.
   /// A privileged operation needs its scope on the token AND a role here
   /// that grants it; unknown values grant nothing.
   roles       String[]                 @default([])
@@ -1466,6 +1544,9 @@ model AgentRepository {
   /// review check passed, CI is green and the merge order check (if any) is
   /// success. Default off.
   markReadyWhenPassing Boolean  @default(false)
+  /// Only on a coding agent's link: the base branch for runs in this repository.
+  /// Null = the coding profile's baseRef.
+  baseRef              String?
   createdAt            DateTime @default(now())
 
   /// How this link was authorized: "host_permission" (the agent owner's
@@ -1671,6 +1752,48 @@ model AgentIssueProject {
   @@index([provider, projectKey])
 }
 
+/// A remote MCP server an owner registered (Streamable HTTP, HTTPS only).
+model McpServer {
+  id           String           @id @default(cuid())
+  ownerId      String
+  owner        Principal        @relation(fields: [ownerId], references: [id], onDelete: Cascade)
+  /// Unique per owner; the prefix of the tool names the model sees.
+  name         String
+  /// https only; no userinfo, no fragment; the query string is kept.
+  url          String
+  /// The owner's brokered secrets sent on every request (each brokered to the URL's host).
+  secretNames  String[]         @default([])
+  /// Last tools/list result, redacted: [{ name, description, inputSchema, annotations? }].
+  toolSnapshot Json             @default("[]")
+  snapshotAt   DateTime?
+  /// From initialize: { name?, version?, protocolVersion }.
+  serverInfo   Json?
+  createdAt    DateTime         @default(now())
+  updatedAt    DateTime         @updatedAt
+  agents       AgentMcpServer[]
+
+  @@unique([ownerId, name])
+  @@index([ownerId])
+}
+
+/// An MCP server attached to an agent, with the server tools it may call.
+model AgentMcpServer {
+  agentId       String
+  agent         Agent     @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  serverId      String
+  server        McpServer @relation(fields: [serverId], references: [id], onDelete: Cascade)
+  /// Exact tool names from the server's saved list. Never empty.
+  allowedTools  String[]
+  /// Per call; null = 30000. Capped by WARDBY_TOOL_MAX_TIMEOUT_MS at call time.
+  callTimeoutMs Int?
+  attachedById  String
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+
+  @@id([agentId, serverId])
+  @@index([serverId])
+}
+
 /// Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
 model IssueFingerprint {
   id              String   @id @default(cuid())
@@ -1953,3 +2076,77 @@ model NotificationThread {
 
   @@unique([provider, channelId, threadKey])
 }
+
+/// A code host implemented by operator-approved custom tools (docs/host-providers.md).
+/// `name` is the prefix of its repository ids: `<name>:<workspace>/<repo>`. Holds no secret values.
+model HostProvider {
+  name                   String   @id
+  contractVersion        Int
+  gitHost                String
+  apiHosts               String[]
+  gitUsername            String
+  pullRequestUrlTemplate String
+  /// Where one repository lives on the API, with `{repository}`: a repository-scoped tool's requests stay under it.
+  repositoryApiPath      String
+  /// The effective-permission endpoint, with `{workspace}` and `{repo}`. Set with a permission secret.
+  permissionApiPath      String?
+  /// How to verify and read a webhook: header names and algorithm, never the secret.
+  webhook                Json
+  webhookSecretId        String
+  webhookSecret          Secret   @relation("HostProviderWebhookSecret", fields: [webhookSecretId], references: [id], onDelete: Restrict)
+  /// Set: ask the host who has access. Unset: trustedAccounts decides.
+  permissionSecretId     String?
+  permissionSecret       Secret?  @relation("HostProviderPermissionSecret", fields: [permissionSecretId], references: [id], onDelete: Restrict)
+  createdById            String
+  createdAt              DateTime @default(now())
+  updatedAt              DateTime @updatedAt
+
+  operations      HostProviderOperation[]
+  credentials     HostProviderCredential[]
+  trustedAccounts HostProviderTrustedAccount[]
+}
+
+/// One approved snapshot: the code Wardby runs. `update_tool` changes nothing here until approved again.
+model HostProviderOperation {
+  provider     String
+  operation    String
+  /// The tool it was copied from. Null once that tool is deleted; the snapshot keeps working.
+  toolId       String?
+  code         String
+  paramsZod    String
+  /// The tool's timeoutMs when it was approved; null = the default limit.
+  timeoutMs    Int?
+  approvedById String
+  approvedAt   DateTime @default(now())
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+  tool         Tool?        @relation(fields: [toolId], references: [id], onDelete: SetNull)
+
+  @@id([provider, operation])
+}
+
+/// Which brokered secret serves which repositories. `credentialKind` is `static` only in v1.
+model HostProviderCredential {
+  id                String @id @default(cuid())
+  provider          String
+  repositoryPattern String
+  secretId          String
+  credentialKind    String @default("static")
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+  secret       Secret       @relation("HostProviderCredentialSecret", fields: [secretId], references: [id], onDelete: Restrict)
+
+  @@unique([provider, repositoryPattern])
+}
+
+/// Host accounts allowed to start runs when the provider has no permission secret.
+model HostProviderTrustedAccount {
+  provider  String
+  accountId String
+  addedById String
+  addedAt   DateTime @default(now())
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+
+  @@id([provider, accountId])
+}

package/scripts/git-askpass.sh

@@ -2,7 +2,7 @@
 
 case "$1" in
   *Username*)
-    printf '%s\n' 'x-access-token'
+    printf '%s\n' "${WARDBY_GIT_USERNAME:-x-access-token}"
     ;;
   *)
     IFS= read -r token <&3